Extracted

• • Target
    Desc_Qtn_350_02_02_pdf.vbs
  • Size 16KB
  • SHA256 42a244583d3a49d5f9dc00ecd99e2d4d2951938faeda0b4baf879f19d82e5525
  • MD5 d2ea4a33c75190336f69b760498b2912
  • SHA1 f8ea2554737e9401619fd5f7cf842adfb3faf10e
  • SHA512 1144b9827db6dcb5a0c46d94ff972300a956e07f351ebeecba7efac0d83e65b3ec6f5fedcd4db80cc95fb8793724ba3521f9a4aaecd6ae3d73269ac45096a23b
  • SSDEEP 192:IDWc7CZgSOKRbfDrmtxGLclTXSVVoDh6vCPKzbYtn1uP5d4P+CTlMPqaojW17J/O:oWOvSOQfDq2UTIV2Uvp4zuxiZNJC/qP
  • TLSH
    T11172853BE908DFF40B2F51E0108F6D06505857A6B53A49ADB4CEC15C7F277108BEA8E8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionxwormrattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2